Arrest in Robinhood Ransomware Case

On May 27, 2025, Iran’s Sina Gholinejad pleaded guilty in a North Carolina federal court. He admitted his involvement in the Robbinhood ransomware attacks, a notorious campaign that harmed city infrastructures, businesses, and healthcare systems across the U.S. This operation, which spanned from January 2019 to March 2024, encrypted vital data and demanded Bitcoin ransoms, inflicting financial losses in the tens of millions and severely disrupting essential services.

The Baltimore ransomware attack of May 2019 stands out as particularly damaging. It forced the city to cut off numerous computers, disrupting services like tax payments and utility billing. The recovery cost Baltimore over $19 million. Other victimized locations were Greenville, North Carolina; Gresham, Oregon; Yonkers, New York; alongside countless nonprofits and healthcare facilities.

The Robbinhood Ransomware Mechanism

Robbinhood ransomware is infamous for its targeted, sophisticated tactics. It gained initial access via compromised admin accounts or unpatched vulnerabilities, before being manually deployed. Key features include:

• Service Disruption: It halts nearly 200 Windows services, targeting antivirus and database systems.
• Network Isolation: Infected machines disconnect from network shares to contain the spread.
• Data Encryption: Files are encrypted with a unique AES key and renamed, making recovery tough.
• Persistence: The malware erases shadow copies and logs, hindering forensic analysis.
• Evasion: It utilizes a legitimate, yet vulnerable driver to disable security defences.

Ransom demands often hit around 3 Bitcoin per machine or 13 Bitcoin for whole networks, with threats of increasing costs and permanent data loss.

Financial Impact and Money Laundering

The financial repercussions of the ransomware attacks were severe. Baltimore’s recovery expenditures alone topped $19 million, with other impacted areas facing similar costs. To mask ransom origins, cybercriminals laundered funds through cryptocurrency mixers and exchanges, employing “chain-hopping” to obscure transactions. Gholinejad and his team used VPNs, European VPSs, and Tor for ransom negotiations, avoiding capture.

Legal Proceedings and Future Implications

Gholinejad’s arrest at Raleigh-Durham International Airport in January 2025 has led to charges carrying a maximum 30-year sentence, with an August court date scheduled. The DOJ, supported by the FBI and international partners, resolved to prosecute cybercriminals targeting critical infrastructure worldwide. This case underscores the evolution of ransomware threats. It highlights the pressing need for strong cybersecurity practices, timely updates, network protection, and disaster recovery strategies in both public and private sectors.

**Guard your data and finances!** Try Qsentinel for robust security, seamless updates, and peace of mind in today’s digital landscape.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.